Description

Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.

Remediation

References

http://packetstormsecurity.com/files/137749/Apache-Qpid-Untrusted-Input-Deserialization.html

https://issues.apache.org/jira/browse/QPIDJMS-188

http://qpid.apache.org/components/jms/security.html

http://qpid.apache.org/components/jms/security-0-x.html

http://www.securityfocus.com/bid/91537

http://www.securitytracker.com/id/1036239

http://www.securityfocus.com/archive/1/538813/100/0/threaded

Related Vulnerabilities

CVE-2021-40822 Vulnerability in maven package org.geoserver:gs-main

CVE-2023-46234 Vulnerability in maven package org.webjars.npm:browserify-sign

CVE-2018-12538 Vulnerability in maven package org.eclipse.jetty:jetty-server

CVE-2021-37580 Vulnerability in maven package org.apache.shenyu:shenyu-admin

CVE-2019-11082 Vulnerability in maven package de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core.api.datasets-asl

Severity

High

Classification

CWE-20 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory VDB Entry Issue Tracking Vendor Advisory